Environment Variables

All configuration options for OpenSRE can be set via environment variables. This page provides a complete reference.

Secret storage

Environment variables are checked first. Credentials you enter through opensre onboard or opensre integrations setup are written to .env and to an owner-only file at ~/.opensre/credentials.json (mode 0600). OpenSRE does not write secrets to the OS keychain. A value in the process environment or a local .env file wins over the credentials file. Keep .env out of source control. Want credentials only from the environment, never on disk? Set OPENSRE_DISABLE_KEYRING=1 and export everything yourself.

LLM providers

Variable	Default	Description
`LLM_PROVIDER`	`anthropic`	Which LLM backend to use — see LLM providers
`LLM_MAX_TOKENS`	`4096`	Max tokens for LLM responses
`OPENSRE_LLM_TRANSPORT`	`sdk`	`sdk` (native SDKs) or `litellm`
`OPENSRE_LLM_NATIVE_STRUCTURED_OUTPUT`		Opt-in provider-native structured outputs (`1`/`true`)

Anthropic

Variable	Default	Description
`ANTHROPIC_API_KEY`		API key for Anthropic
`ANTHROPIC_REASONING_MODEL`		Model for reasoning tasks
`ANTHROPIC_TOOLCALL_MODEL`		Model for tool calling

OpenAI

Variable	Default	Description
`OPENAI_API_KEY`		API key for OpenAI
`OPENAI_REASONING_MODEL`		Model for reasoning tasks
`OPENAI_TOOLCALL_MODEL`		Model for tool calling

OpenRouter

Variable	Default	Description
`OPENROUTER_API_KEY`		API key for OpenRouter
`OPENROUTER_MODEL`		Shared model for all tasks
`OPENROUTER_REASONING_MODEL`		Override model for reasoning
`OPENROUTER_TOOLCALL_MODEL`		Override model for tool calling

TrustedRouter

Variable	Default	Description
`TRUSTEDROUTER_API_KEY`		API key for TrustedRouter
`TRUSTEDROUTER_MODEL`		Shared model for all tasks
`TRUSTEDROUTER_REASONING_MODEL`		Override model for reasoning
`TRUSTEDROUTER_TOOLCALL_MODEL`		Override model for tool calling

DeepSeek

Variable	Default	Description
`DEEPSEEK_API_KEY`		API key for DeepSeek
`DEEPSEEK_MODEL`		Shared model for all tasks
`DEEPSEEK_REASONING_MODEL`		Override model for reasoning
`DEEPSEEK_TOOLCALL_MODEL`		Override model for tool calling

Google Gemini

Variable	Default	Description
`GEMINI_API_KEY`		API key for Google Gemini
`GEMINI_MODEL`		Shared model for all tasks
`GEMINI_REASONING_MODEL`		Override model for reasoning
`GEMINI_TOOLCALL_MODEL`		Override model for tool calling

NVIDIA

Variable	Default	Description
`NVIDIA_API_KEY`		API key for NVIDIA NIM
`NVIDIA_MODEL`		Shared model for all tasks
`NVIDIA_REASONING_MODEL`		Override model for reasoning
`NVIDIA_TOOLCALL_MODEL`		Override model for tool calling

MiniMax

Variable	Default	Description
`MINIMAX_API_KEY`		API key for MiniMax
`MINIMAX_MODEL`		Shared model for all tasks
`MINIMAX_REASONING_MODEL`		Override model for reasoning
`MINIMAX_TOOLCALL_MODEL`		Override model for tool calling

Groq

Variable	Default	Description
`GROQ_API_KEY`		API key for Groq
`GROQ_MODEL`		Shared model for all tasks
`GROQ_REASONING_MODEL`		Override model for reasoning
`GROQ_TOOLCALL_MODEL`		Override model for tool calling

Azure OpenAI

Variable	Default	Description
`AZURE_OPENAI_BASE_URL`		Azure OpenAI resource URL (`https://<resource>.openai.azure.com`)
`AZURE_OPENAI_API_KEY`		API key for Azure OpenAI
`AZURE_OPENAI_API_VERSION`	`2024-10-21`	Azure OpenAI API version
`AZURE_OPENAI_MODEL`		Shared deployment name for all slots
`AZURE_OPENAI_REASONING_MODEL`	`gpt-5.4-mini`	Deployment for reasoning tasks
`AZURE_OPENAI_CLASSIFICATION_MODEL`	`gpt-5.4-mini`	Deployment for classification
`AZURE_OPENAI_TOOLCALL_MODEL`	`gpt-5.4-mini`	Deployment for tool calling

Amazon Bedrock

Variable	Default	Description
`BEDROCK_REASONING_MODEL`		Model for reasoning tasks
`BEDROCK_TOOLCALL_MODEL`		Model for tool calling
`BEDROCK_CLASSIFICATION_MODEL`	`us.anthropic.claude-sonnet-4-6`	Model for classification

Google Vertex AI

Variable	Default	Description
`VERTEX_AI_PROJECT`		GCP project ID (required for Vertex)
`VERTEX_AI_LOCATION`	`us-central1`	Vertex AI region
`VERTEX_AI_REASONING_MODEL`	`gemini-2.5-pro`	Model for reasoning
`VERTEX_AI_TOOLCALL_MODEL`	`gemini-2.5-flash-lite`	Model for tool calling
`VERTEX_AI_CLASSIFICATION_MODEL`	`gemini-2.5-flash`	Model for classification
`VERTEX_AI_MODEL`		Shared model override for all slots

Ollama (Local)

Variable	Default	Description
`OLLAMA_MODEL`	`llama3.2`	Model name in Ollama
`OLLAMA_HOST`	`http://localhost:11434`	Ollama server URL

LLM Reasoning Effort

Variable	Default	Description
`OPENSRE_REASONING_EFFORT`		Effort for extended-thinking models: `low`, `medium`, `high`, or `xhigh`

CLI investigation tools

Codex

Variable	Default	Description
`CODEX_BIN`		Path to Codex CLI binary
`CODEX_MODEL`		Model override for Codex

Claude Code

Variable	Default	Description
`CLAUDE_CODE_BIN`		Path to Claude Code CLI binary
`CLAUDE_CODE_MODEL`		Model override for Claude Code

Gemini CLI

Variable	Default	Description
`GEMINI_CLI_BIN`		Path to Gemini CLI binary
`GEMINI_CLI_MODEL`		Model override for Gemini CLI

Antigravity

Variable	Default	Description
`ANTIGRAVITY_CLI_BIN`		Path to Antigravity CLI binary
`ANTIGRAVITY_CLI_MODEL`		Model override for Antigravity
`ANTIGRAVITY_CLI_TIMEOUT_SECONDS`		Timeout for Antigravity CLI invocations

OpenCode

Variable	Default	Description
`OPENCODE_BIN`		Path to OpenCode CLI binary
`OPENCODE_MODEL`		Model override for OpenCode

Cursor

Variable	Default	Description
`CURSOR_BIN`		Path to Cursor CLI binary
`CURSOR_MODEL`		Model override for Cursor

Kimi

Variable	Default	Description
`KIMI_BIN`		Path to Kimi CLI binary
`KIMI_MODEL`		Model override for Kimi
`KIMI_API_KEY`		API key for Kimi

GitHub Copilot

Variable	Default	Description
`COPILOT_BIN`		Path to GitHub Copilot CLI binary
`COPILOT_MODEL`		Model override for Copilot
`COPILOT_HOME`		Copilot config directory override
`COPILOT_GITHUB_TOKEN`		GitHub token for Copilot auth

Grok / xAI

Variable	Default	Description
`GROK_CLI_BIN`		Path to Grok Build CLI binary
`GROK_CLI_MODEL`		Model override for Grok Build CLI
`XAI_API_KEY`		API-key auth for Grok Build CLI
`XAI_BASE_URL`		Override xAI API base URL
`GROK_CLI_TIMEOUT_SECONDS`	`300`	Timeout for Grok CLI invocations

Variable	Default	Description
`PI_BIN`		Path to Pi CLI binary
`PI_MODEL`		Model override for Pi CLI (`provider/model`)
`PI_AGENT_DIR`		Pi agent config directory override
`PI_CONFIG_DIR`		Pi config directory override

Custom endpoints

Variable	Default	Description
`CUSTOM_OPENAI_BASE_URL`		Base URL for an OpenAI-compatible gateway
`CUSTOM_OPENAI_API_KEY`		API key for `custom-openai`
`CUSTOM_OPENAI_MODEL`		Shared model for all `custom-openai` roles
`CUSTOM_OPENAI_TOOLCALL_MODEL`		Optional toolcall-model override
`CUSTOM_ANTHROPIC_BASE_URL`		Base URL for an Anthropic-compatible gateway
`CUSTOM_ANTHROPIC_API_KEY`		API key for `custom-anthropic`
`CUSTOM_ANTHROPIC_MODEL`		Shared model for all `custom-anthropic` roles

Output & Debugging

Variable	Default	Description
`TRACER_VERBOSE`	`0`	Verbose OpenSRE CLI/UI output (`1`, `true`, `yes`)
`TRACER_OUTPUT_FORMAT`		OpenSRE result output format
`TRACER_API_URL`		Base URL for the tracer observability integration / report delivery
`NO_COLOR`		Disable colored output (standard convention)
`COLUMNS`	`80`	Terminal column width for output formatting
`ENV`	`development`	Environment (`development`, `production`)

Credentials and authentication

For secrets (*_TOKEN, *_KEY, *_PASSWORD, *_SECRET, and similar), OpenSRE looks in this order:

Your process environment
The owner-only file ~/.opensre/credentials.json

opensre onboard saves credentials there so they still work after you clear .env. Not stored as secrets: webhook-style URLs such as SLACK_WEBHOOK_URL and ROCKETCHAT_WEBHOOK_URL. Those stay in env / store only — treat them as secrets and don’t log them. Want credentials only from the environment, never on disk? Set OPENSRE_DISABLE_KEYRING=1 and export everything yourself.

Variable	Default	Description
`OPENSRE_DISABLE_KEYRING`	`0`	Disable local credential storage; credentials must come from the environment
`OPENSRE_LLM_AUTH_METADATA_PATH`	`~/.opensre/llm-auth.json`	Non-secret LLM auth metadata path used by prompt-safe status checks
`OPENSRE_API_KEY`		API key for remote OpenSRE instances

Telemetry & Monitoring

Variable	Default	Description
`OPENSRE_NO_TELEMETRY`	`0`	Disable all telemetry, including Sentry and PostHog (covers `$ai_generation` prompt/response events)
`OPENSRE_ANALYTICS_DISABLED`	`0`	Disable PostHog analytics only
`OPENSRE_SENTRY_DISABLED`	`0`	Disable Sentry error reporting
`OPENSRE_SENTRY_DSN`		Override Sentry DSN
`OPENSRE_SENTRY_LOGGING_DISABLED`	`0`	Disable Sentry log integration
`OPENSRE_DEPLOYMENT_METHOD`	`local`	Sentry deployment tag: railway, ec2, vercel, or local
`OPENSRE_PROMPT_LOG_DISABLED`	`0`	Disable prompt logging entirely
`OPENSRE_PROMPT_LOG_LOCAL_DISABLED`	`0`	Disable local prompt log file
`OPENSRE_PROMPT_LOG_REDACT`	`1`	Redact known token shapes from prompts/responses before local or PostHog logging
`OPENSRE_PROMPT_LOG_PATH`	`~/.opensre/prompt_log.jsonl`	Path to local prompt log file
`OPENSRE_OPERATIONS_LOG_DISABLED`	`0`	Disable the local operations log
`OPENSRE_OPERATIONS_LOG_PATH`	`~/.opensre/operations_log.jsonl`	Path to the local operations log
`OPENSRE_OPERATIONS_LOG_MAX_BYTES`	`5242880`	Rotate the local operations log after this many bytes
`DO_NOT_TRACK`	`0`	Honor global do-not-track preference
`SENTRY_TRACES_SAMPLE_RATE`	`1.0`	Trace sampling rate for Sentry
`SENTRY_ERROR_SAMPLE_RATE`	`1.0`	Error sampling rate for Sentry

Paths & Directories

Variable	Default	Description
`INVESTIGATIONS_DIR`	`~/.opensre/investigations`	Directory for saved investigations
`OPENSRE_HOME`	`~/.opensre`	Root directory for local OpenSRE state
`OPENSRE_PROJECT_ENV_PATH`	`PROJECT_ROOT/.env`	Path to project-level `.env` file
`OPENSRE_WIZARD_STORE_PATH`	`~/.opensre/opensre.json`	Path to the local wizard/provider selection store
`OPENSRE_CONTEXT_ROOT`		Override OpenSRE home/context root
`OPENSRE_INTEGRATIONS_STORE_PATH`		Override integrations store path

Memory

Variable	Default	Description
`OPENSRE_MEMORY_DISABLED`	`0`	Disable long-term memory
`OPENSRE_MEMORY_DIR`		Override memory storage directory
`OPENSRE_MEMORY_AUTOEXTRACT_DISABLED`	`0`	Disable automatic memory extraction
`OPENSRE_MEMORY_GATEWAY_ENABLED`	`0`	Opt-in memory on shared gateway hosts

Remote sync

Mirror conversation history and memory to a user-owned object store. Details: Remote sync.

Variable	Default	Description
`OPENSRE_REMOTE_SYNC`		Enable remote sync (`1`/`true`)
`OPENSRE_REMOTE_SYNC_PROVIDER`	`aws`	Store backend (`aws`, `gcs`, `vercel`, `azure`, or `s3compat`)
`OPENSRE_REMOTE_SYNC_BUCKET`		Bucket / Blob store name (required when sync is on)
`OPENSRE_REMOTE_SYNC_PREFIX`	`opensre`	Key prefix inside the store
`OPENSRE_REMOTE_SYNC_REGION`		Region override
`OPENSRE_REMOTE_SYNC_PROFILE`		Named credentials profile
`OPENSRE_REMOTE_SYNC_ENDPOINT_URL`		Custom S3 endpoint when provider is `s3compat`
`OPENSRE_REMOTE_SYNC_EXCLUDE`		Comma-separated globs to exclude from sync
`OPENSRE_REMOTE_SYNC_EXCLUDE_OFF`		Ignore configured exclusions for one run
`BLOB_READ_WRITE_TOKEN`		Vercel Blob token (when provider is `vercel`)

Masking

Variable	Default	Description
`OPENSRE_MASK_ENABLED`	`false`	Enable reversible identifier masking before external LLM calls
`OPENSRE_MASK_KINDS`		Comma-separated mask kinds to enable
`OPENSRE_MASK_EXTRA_REGEX`		JSON map of extra mask kinds to regex patterns

Feature Flags

Variable	Default	Description
`OSRE_HELM_INTEGRATION`		Enable Helm integration (1/true/yes)
`HELM_PATH`	`helm`	Path to the Helm binary
`HELM_KUBE_CONTEXT`		kubectl context for Helm
`HELM_KUBECONFIG`		kubeconfig path for Helm
`HELM_NAMESPACE`		Default Helm namespace
`GITLAB_MR_WRITEBACK`		Enable GitLab merge request writeback (`true`, `1`, `yes`)
`OPENSRE_RELEASES_API_URL`	GitHub releases API	Override releases API endpoint

Integration credentials

Observability & Monitoring

Variable	Default	Description
`GRAFANA_INSTANCE_URL`		Grafana instance URL
`GRAFANA_READ_TOKEN`		Grafana API token
`GRAFANA_WRITE_TOKEN`		Grafana token for writing annotations (log sink)
`GRAFANA_LOKI_PUSH_URL`		Loki push URL for the Grafana investigation log sink
`GRAFANA_LOKI_DATASOURCE_UID`		UID of Loki datasource in Grafana
`GRAFANA_TEMPO_DATASOURCE_UID`		UID of Tempo datasource in Grafana
`GRAFANA_MIMIR_DATASOURCE_UID`		UID of Mimir datasource in Grafana
`TEMPO_URL`		Grafana Tempo / Tempo API base URL
`TEMPO_API_KEY`		Tempo API key (or use username/password)
`TEMPO_USERNAME`		Tempo basic-auth username
`TEMPO_PASSWORD`		Tempo basic-auth password
`TEMPO_ORG_ID`		Tempo org ID (multi-tenant)
`GRAFANA_VERIFY_SSL`	`true`	Verify Grafana SSL certificate
`GRAFANA_CA_BUNDLE`		Path to a CA bundle for Grafana TLS verification (self-signed/internal CA)
`DD_API_KEY`		Datadog API key
`DD_APP_KEY`		Datadog application key
`DD_SITE`	`datadoghq.com`	Datadog site (us/eu)
`GROUNDCOVER_API_KEY`		groundcover read-only service-account token (alias: `GROUNDCOVER_MCP_TOKEN`)
`GROUNDCOVER_MCP_URL`	`https://mcp.groundcover.com/api/mcp`	groundcover MCP endpoint
`GROUNDCOVER_TENANT_UUID`		Tenant UUID (multi-workspace accounts)
`GROUNDCOVER_BACKEND_ID`		Backend ID (multi-backend tenants)
`GROUNDCOVER_TIMEZONE`	`UTC`	Timezone for returned timestamps (`X-Timezone`)
`HONEYCOMB_API_KEY`		Honeycomb API key
`HONEYCOMB_DATASET`	`__all__`	Honeycomb dataset slug
`HONEYCOMB_API_URL`	`https://api.honeycomb.io`	Honeycomb API endpoint
`CORALOGIX_API_KEY`		Coralogix API key
`CORALOGIX_API_URL`	`https://api.coralogix.com`	Coralogix API endpoint
`CORALOGIX_APPLICATION_NAME`		Application name in Coralogix
`CORALOGIX_SUBSYSTEM_NAME`		Subsystem name in Coralogix
`SIGNOZ_URL`		SigNoz instance URL
`SIGNOZ_API_KEY`		SigNoz API key
`ALERTMANAGER_URL`		Alertmanager URL
`ALERTMANAGER_BEARER_TOKEN`		Bearer token for Alertmanager
`ALERTMANAGER_USERNAME`		Username for Alertmanager basic auth
`ALERTMANAGER_PASSWORD`		Password for Alertmanager basic auth
`SPLUNK_URL`		Splunk instance URL
`SPLUNK_TOKEN`		Splunk API token
`SPLUNK_INDEX`	`main`	Splunk index
`SPLUNK_VERIFY_SSL`	`true`	Verify Splunk SSL certificate
`SPLUNK_CA_BUNDLE`		Path to a CA bundle for Splunk TLS verification
`SENTRY_URL`	`https://sentry.io`	Sentry instance URL
`SENTRY_ORG_SLUG`		Sentry organization slug
`SENTRY_PROJECT_SLUG`		Sentry project slug
`SENTRY_AUTH_TOKEN`		Sentry auth token
`POSTHOG_PROJECT_ID`		PostHog project ID
`POSTHOG_PERSONAL_API_KEY`		PostHog personal API key
`POSTHOG_BASE_URL`	`https://us.i.posthog.com`	PostHog API instance base URL
`POSTHOG_TIMEOUT_SECONDS`	`15.0`	Timeout in seconds for PostHog API requests
`NEW_RELIC_API_KEY`		New Relic User key (`NRAK-...`)
`NEW_RELIC_ACCOUNT_ID`		New Relic account ID
`NEW_RELIC_API_URL`	`https://api.newrelic.com`	New Relic API URL (EU/JP endpoints supported)

Cloud Platforms

Variable	Default	Description
`AWS_REGION`	`us-east-1`	AWS region
`AWS_ROLE_ARN`		AWS role ARN for cross-account access
`AWS_EXTERNAL_ID`		External ID for AWS cross-account role
`AWS_ACCESS_KEY_ID`		AWS access key
`AWS_SECRET_ACCESS_KEY`		AWS secret access key
`AWS_SESSION_TOKEN`		AWS session token
`CLOUD_PROVIDER`		Cloud provider hint for ambient region discovery
`CLOUD_REGION`		Cloud region (falls back to `AWS_REGION`)
`KUBECONFIG`		Path to kubeconfig file
`KUBECONFIG_CONTENT`		Inline kubeconfig contents
`KUBECONFIG_CONTEXT`		kubectl context
`KUBECONFIG_NAMESPACE`	`default`	Default Kubernetes namespace
`RDS_DB_INSTANCE_IDENTIFIER`		AWS RDS DB instance identifier
`RDS_REGION`		AWS region for RDS (falls back to `AWS_REGION`)
`RAILWAY_TOKEN`		Railway API token
`RAILWAY_PROJECT`		Railway project
`RAILWAY_SERVICE`		Railway service
`RAILWAY_ENVIRONMENT`	`production`	Railway environment
`RAILWAY_PATH`	`railway`	Path to Railway CLI
`ARGOCD_BASE_URL`		Argo CD API base URL
`ARGOCD_AUTH_TOKEN`		Argo CD auth token
`ARGOCD_TOKEN`		Alias for `ARGOCD_AUTH_TOKEN`
`ARGOCD_USERNAME`		Argo CD username (basic auth)
`ARGOCD_PASSWORD`		Argo CD password (basic auth)
`ARGOCD_PROJECT`		Argo CD project
`ARGOCD_APP_NAMESPACE`		Argo CD app namespace
`ARGOCD_VERIFY_SSL`	`true`	Verify Argo CD TLS
`YC_FOLDER_ID`		Yandex Cloud folder ID
`YC_CLOUD_ID`		Yandex Cloud cloud ID
`YC_SA_KEY_FILE`		Path to a Yandex Cloud service-account key JSON file
`YC_SA_KEY`		Yandex Cloud service-account key, inline
`YC_TOKEN`		Yandex Cloud OAuth token
`YC_IAM_TOKEN`		Yandex Cloud IAM token
`YC_USE_METADATA`		Use the Yandex Cloud VM metadata service (`true`)

Messaging

Variable	Default	Description
`SLACK_WEBHOOK_URL`		Slack incoming webhook URL
`SLACK_BOT_TOKEN`		Slack bot token
`SLACK_DEFAULT_CHAT_ID`		Default Slack channel for scheduled delivery (bot-token path)
`SLACK_APP_TOKEN`		Slack app-level token (Socket Mode)
`SLACK_GATEWAY_INBOUND_TRANSPORT`	`socket_mode`	How Slack delivers events: `socket_mode` or `events_api_http`
`SLACK_SIGNING_SECRET`		Request-signature secret. Required for `events_api_http`
`SLACK_GATEWAY_HTTP_PORT`	`3000`	Port the `events_api_http` listener binds
`SLACK_GATEWAY_ALLOW_LOCAL_DEDUP`		Accept process-local event dedup when `DATABASE_URL` is unset. Single replica only
`SLACK_ALLOWED_USERS`		Comma-separated Slack user IDs allowed to talk to the bot
`SLACK_ALLOW_OPEN_WORKSPACE`		Allow any workspace user (`1` for dogfood)
`SLACK_ACCESS_TOKEN`		Slack user token
`SLACK_GITHUB_ISSUES_WEBHOOK_URL`		Slack webhook for GitHub issues
`DISCORD_BOT_TOKEN`		Discord bot token
`DISCORD_APPLICATION_ID`		Discord application ID
`DISCORD_PUBLIC_KEY`		Discord public key
`DISCORD_DEFAULT_CHANNEL_ID`		Default Discord channel
`DISCORD_ALLOWED_USERS`		Comma-separated Discord user IDs allowed to talk to the bot
`DISCORD_ALLOW_OPEN_GUILD`		Allow any guild member (`1` for dogfood)
`TELEGRAM_BOT_TOKEN`		Telegram bot token
`TELEGRAM_DEFAULT_CHAT_ID`		Default Telegram chat ID
`TELEGRAM_ALLOWED_USERS`		Comma-separated Telegram user IDs allowed to talk to the bot
`ROCKETCHAT_SERVER_URL`		Rocket.Chat server base URL
`ROCKETCHAT_AUTH_TOKEN`		Rocket.Chat personal access token
`ROCKETCHAT_USER_ID`		Rocket.Chat user ID for the token
`ROCKETCHAT_DEFAULT_CHANNEL`		Default Rocket.Chat channel
`ROCKETCHAT_WEBHOOK_URL`		Rocket.Chat incoming webhook URL
`TWILIO_ACCOUNT_SID`		Twilio account SID
`TWILIO_AUTH_TOKEN`		Twilio auth token
`TWILIO_WHATSAPP_FROM`		WhatsApp sender number (Twilio)
`WHATSAPP_DEFAULT_TO`		Default WhatsApp recipient
`TWILIO_SMS_FROM`		SMS sender number (Twilio)
`TWILIO_SMS_MESSAGING_SERVICE_SID`		SMS messaging service SID
`TWILIO_SMS_DEFAULT_TO`		Default SMS recipient
`SMTP_HOST`		SMTP server hostname
`SMTP_PORT`	`587`	SMTP port
`SMTP_SECURITY`	`starttls`	SMTP security (`starttls`, `ssl`, or `none`)
`SMTP_USERNAME`		SMTP username
`SMTP_PASSWORD`		SMTP password
`SMTP_FROM_ADDRESS`		From address for outbound mail
`SMTP_DEFAULT_TO`		Default recipient for notifications

Code & Collaboration

Variable	Default	Description
`GITHUB_MCP_MODE`	`streamable-http`	GitHub MCP transport mode
`GITHUB_MCP_URL`		GitHub MCP server URL
`GITHUB_MCP_COMMAND`		GitHub MCP command to execute
`GITHUB_MCP_ARGS`		GitHub MCP command arguments
`GITHUB_MCP_AUTH_TOKEN`		GitHub MCP auth token
`GITHUB_MCP_TOOLSETS`	`repos,issues,pull_requests,actions,search`	Enabled GitHub MCP toolsets
`OPENSRE_GITHUB_MCP_REPO_PROBE_LIMIT`	`50`	Max repos to probe (5-500)
`GITLAB_BASE_URL`		GitLab instance URL
`GITLAB_ACCESS_TOKEN`		GitLab personal access token
`GITLAB_PROJECT_ID`		GitLab project ID
`GITLAB_REPO_URL`		GitLab repository URL
`GITLAB_MR_IID`		Merge request IID for writeback context
`JIRA_BASE_URL`		Jira instance URL
`JIRA_EMAIL`		Jira user email
`JIRA_API_TOKEN`		Jira API token
`JIRA_PROJECT_KEY`		Default Jira project key
`BITBUCKET_WORKSPACE`		Bitbucket workspace name
`BITBUCKET_USERNAME`		Bitbucket username
`BITBUCKET_APP_PASSWORD`		Bitbucket app password
`BITBUCKET_MAX_RESULTS`	`25`	Max results per API call
`INCIDENT_IO_BASE_URL`		incident.io API URL
`INCIDENT_IO_API_KEY`		incident.io API key
`PAGERDUTY_API_KEY`		PagerDuty API key
`PAGERDUTY_BASE_URL`		PagerDuty API base URL
`SERVICENOW_INSTANCE_URL`		ServiceNow instance URL
`SERVICENOW_USERNAME`		ServiceNow username
`SERVICENOW_PASSWORD`		ServiceNow password
`OPSGENIE_API_KEY`		Opsgenie API key
`OPSGENIE_REGION`	`us`	Opsgenie region (us/eu)
`VERCEL_API_TOKEN`		Vercel API token
`VERCEL_TEAM_ID`		Vercel team ID
`VERCEL_POLL_PROJECT_IDS`		Project IDs for Vercel polling (CSV)
`VERCEL_RUNTIME_LOGS_READ_TIMEOUT`	`600`	Seconds to wait per Vercel runtime-log read (minimum `30`)
`GOOGLE_CREDENTIALS_FILE`		Path to Google service-account JSON for Docs export
`GOOGLE_DRIVE_FOLDER_ID`		Google Drive folder for Docs export

Databases

Variable	Default	Description
`MONGODB_CONNECTION_STRING`		MongoDB connection string
`MONGODB_DATABASE`		MongoDB database name
`MONGODB_AUTH_SOURCE`	`admin`	MongoDB auth source
`MONGODB_TLS`	`true`	Enable MongoDB TLS
`MONGODB_ATLAS_PUBLIC_KEY`		MongoDB Atlas public API key
`MONGODB_ATLAS_PRIVATE_KEY`		MongoDB Atlas private API key
`MONGODB_ATLAS_PROJECT_ID`		MongoDB Atlas project ID
`MONGODB_ATLAS_BASE_URL`	`https://cloud.mongodb.com/api/atlas/v2`	MongoDB Atlas API base URL
`REDIS_HOST`		Redis host
`REDIS_PORT`	`6379`	Redis port
`REDIS_USERNAME`		Redis ACL username (Redis 6+)
`REDIS_PASSWORD`		Redis password
`REDIS_DATABASE`	`0`	Redis database number
`REDIS_SSL`	`false`	Connect using TLS
`POSTGRESQL_HOST`		PostgreSQL host
`POSTGRESQL_PORT`	`5432`	PostgreSQL port
`POSTGRESQL_DATABASE`		PostgreSQL database name
`POSTGRESQL_USERNAME`	`postgres`	PostgreSQL username
`POSTGRESQL_PASSWORD`		PostgreSQL password
`POSTGRESQL_SSL_MODE`	`prefer`	PostgreSQL SSL mode
`MYSQL_HOST`		MySQL host
`MYSQL_PORT`	`3306`	MySQL port
`MYSQL_DATABASE`		MySQL database name
`MYSQL_USERNAME`	`root`	MySQL username
`MYSQL_PASSWORD`		MySQL password
`MYSQL_SSL_MODE`	`preferred`	MySQL SSL mode
`MARIADB_HOST`		MariaDB host
`MARIADB_PORT`	`3306`	MariaDB port
`MARIADB_DATABASE`		MariaDB database name
`MARIADB_USERNAME`		MariaDB username
`MARIADB_PASSWORD`		MariaDB password
`MARIADB_SSL`	`true`	Enable MariaDB SSL

Message Queues & Other Services

Variable	Default	Description
`RABBITMQ_HOST`		RabbitMQ host
`RABBITMQ_MANAGEMENT_PORT`	`15672`	RabbitMQ management port
`RABBITMQ_USERNAME`		RabbitMQ username
`RABBITMQ_PASSWORD`		RabbitMQ password
`RABBITMQ_VHOST`	`/`	RabbitMQ vhost
`RABBITMQ_SSL`	`false`	Enable RabbitMQ SSL
`RABBITMQ_VERIFY_SSL`	`true`	Verify RabbitMQ SSL certificate
`BETTERSTACK_QUERY_ENDPOINT`		Better Stack query endpoint
`BETTERSTACK_USERNAME`		Better Stack username
`BETTERSTACK_PASSWORD`		Better Stack password
`BETTERSTACK_SOURCES`		Better Stack sources
`KAFKA_BOOTSTRAP_SERVERS`		Kafka broker addresses
`KAFKA_SECURITY_PROTOCOL`	`PLAINTEXT`	Kafka security protocol
`KAFKA_SASL_MECHANISM`		Kafka SASL mechanism
`KAFKA_SASL_USERNAME`		Kafka SASL username
`KAFKA_SASL_PASSWORD`		Kafka SASL password
`DAGSTER_ENDPOINT`		Dagster GraphQL endpoint
`DAGSTER_API_TOKEN`		Dagster Cloud User Token (leave empty for unauthenticated local OSS)
`TEMPORAL_API_URL`		Temporal Cloud / server API URL
`TEMPORAL_NAMESPACE`	`default`	Temporal namespace
`TEMPORAL_API_KEY`		Temporal API key (optional for local)
`JENKINS_URL`		Jenkins base URL
`JENKINS_USER`		Jenkins username
`JENKINS_API_TOKEN`		Jenkins API token

Data & Search

Variable	Default	Description
`OPENSEARCH_URL`		OpenSearch instance URL
`OPENSEARCH_USERNAME`		OpenSearch username
`OPENSEARCH_PASSWORD`		OpenSearch password
`OPENSEARCH_API_KEY`		OpenSearch API key (alternative to username/password)
`OPENSEARCH_INDEX_PATTERN`	`*`	OpenSearch index pattern
`OPENSEARCH_MAX_RESULTS`	`100`	Max OpenSearch results
`OPENOBSERVE_URL`		OpenObserve instance URL
`OPENOBSERVE_TOKEN`		OpenObserve API token
`OPENOBSERVE_USERNAME`		OpenObserve username
`OPENOBSERVE_PASSWORD`		OpenObserve password
`OPENOBSERVE_ORG`	`default`	OpenObserve organization
`OPENOBSERVE_STREAM`		OpenObserve stream
`OPENOBSERVE_MAX_RESULTS`	`100`	Max OpenObserve results
`VICTORIA_LOGS_URL`		VictoriaLogs instance URL
`VICTORIA_LOGS_TENANT_ID`		VictoriaLogs tenant ID
`HERMES_LOG_PATH`	`~/.hermes/logs/errors.log`	Default path and path sandbox for the `get_hermes_logs` tool
`OPENSRE_HERMES_INVESTIGATE`		Set to `1` to enable Hermes watch auto-investigation when the CLI flag is omitted
`CLICKHOUSE_HOST`		ClickHouse host
`CLICKHOUSE_PORT`	`8123`	ClickHouse port
`CLICKHOUSE_DATABASE`	`default`	ClickHouse database
`CLICKHOUSE_USER`	`default`	ClickHouse username
`CLICKHOUSE_PASSWORD`		ClickHouse password
`CLICKHOUSE_SECURE`	`false`	Enable ClickHouse TLS
`SNOWFLAKE_ACCOUNT_IDENTIFIER`		Snowflake account identifier
`SNOWFLAKE_ACCOUNT`		Snowflake account (alternative)
`SNOWFLAKE_TOKEN`		Snowflake token
`SNOWFLAKE_USER`		Snowflake username
`SNOWFLAKE_PASSWORD`		Snowflake password
`SNOWFLAKE_WAREHOUSE`		Snowflake warehouse
`SNOWFLAKE_ROLE`		Snowflake role
`SNOWFLAKE_DATABASE`		Snowflake database
`SNOWFLAKE_SCHEMA`		Snowflake schema
`SNOWFLAKE_MAX_RESULTS`	`50`	Max Snowflake results
`AZURE_SQL_SERVER`		Azure SQL server name
`AZURE_SQL_DATABASE`		Azure SQL database name
`AZURE_SQL_PORT`	`1433`	Azure SQL port
`AZURE_SQL_USERNAME`		Azure SQL username
`AZURE_SQL_PASSWORD`		Azure SQL password
`AZURE_SQL_DRIVER`	`ODBC Driver 18 for SQL Server`	Azure SQL ODBC driver
`AZURE_SQL_ENCRYPT`	`true`	Enable Azure SQL encryption
`AZURE_LOG_ANALYTICS_WORKSPACE_ID`		Azure Log Analytics workspace ID
`AZURE_LOG_ANALYTICS_TOKEN`		Azure Log Analytics token
`AZURE_LOG_ANALYTICS_ENDPOINT`	`https://api.loganalytics.io`	Log Analytics Query API endpoint (sovereign clouds)
`AZURE_TENANT_ID`		Azure tenant ID
`AZURE_SUBSCRIPTION_ID`		Azure subscription ID
`AZURE_MAX_RESULTS`	`100`	Max Azure results

MCP Servers

Variable	Default	Description
`OPENCLAW_MCP_URL`		OpenClaw MCP server URL
`OPENCLAW_MCP_COMMAND`		OpenClaw MCP command to execute
`OPENCLAW_MCP_MODE`	`streamable-http`	OpenClaw MCP transport mode
`OPENCLAW_MCP_ARGS`		OpenClaw MCP command arguments
`OPENCLAW_MCP_AUTH_TOKEN`		OpenClaw MCP auth token
`POSTHOG_MCP_MODE`	`streamable-http`	PostHog MCP transport mode
`POSTHOG_MCP_URL`	`https://mcp.posthog.com/mcp`	PostHog MCP URL
`POSTHOG_MCP_AUTH_TOKEN`		PostHog MCP auth token
`POSTHOG_MCP_PROJECT_ID`		PostHog project scoped to MCP
`POSTHOG_MCP_ORGANIZATION_ID`		PostHog organization scoped to MCP
`POSTHOG_MCP_FEATURES`		Comma-separated PostHog MCP features
`POSTHOG_MCP_READ_ONLY`	`true`	Restrict PostHog MCP to read-only
`POSTHOG_MCP_COMMAND`		PostHog MCP stdio command
`POSTHOG_MCP_ARGS`		PostHog MCP stdio args
`SENTRY_MCP_MODE`	`streamable-http`	Sentry MCP transport mode
`SENTRY_MCP_URL`	`https://mcp.sentry.dev/mcp`	Sentry MCP URL
`SENTRY_MCP_AUTH_TOKEN`		Sentry MCP auth token
`SENTRY_MCP_HOST`		Self-hosted Sentry MCP host
`SENTRY_MCP_ORGANIZATION_SLUG`		Sentry org slug for MCP
`SENTRY_MCP_PROJECT_SLUG`		Sentry project slug for MCP
`SENTRY_MCP_SKILLS`		Enabled Sentry MCP skills
`SENTRY_MCP_COMMAND`		Sentry MCP stdio command
`SENTRY_MCP_ARGS`		Sentry MCP stdio args
`X_MCP_MODE`	`streamable-http`	X MCP transport mode
`X_MCP_URL`	`http://127.0.0.1:8000/mcp`	X MCP URL
`X_MCP_AUTH_TOKEN`		X MCP transport auth token
`X_MCP_COMMAND`		X MCP stdio command
`X_MCP_ARGS`		X MCP stdio args
`X_BEARER_TOKEN`		X API bearer token (not MCP transport auth)

Git Integrations

Variable	Default	Description
`GITHUB_EVENT_PATH`		GitHub Actions event payload path
`GITHUB_REPOSITORY`		GitHub repository (owner/repo)
`GITHUB_TOKEN`		GitHub personal access token
`GH_TOKEN`		Alias for `GITHUB_TOKEN`

Multi-instance integrations

Need more than one Datadog, Grafana, or AWS account (for example prod and staging)? Use a JSON *_INSTANCES variable:

Variable	What it configures
`GRAFANA_INSTANCES`	Multiple Grafana instances
`DD_INSTANCES`	Multiple Datadog sites/accounts
`GROUNDCOVER_INSTANCES`	Multiple groundcover instances
`HONEYCOMB_INSTANCES`	Multiple Honeycomb instances
`CORALOGIX_INSTANCES`	Multiple Coralogix instances
`SPLUNK_INSTANCES`	Multiple Splunk instances
`AWS_INSTANCES`	Multiple AWS accounts
`ARGOCD_INSTANCES`	Multiple Argo CD instances

Format and examples: Multi-instance integrations.

LLM classification models

If you don’t set these, OpenSRE falls back to the reasoning model (or the provider default):

Variable	Default	Description
`ANTHROPIC_CLASSIFICATION_MODEL`		Anthropic classification model
`OPENAI_CLASSIFICATION_MODEL`		OpenAI classification model
`OPENROUTER_CLASSIFICATION_MODEL`		OpenRouter classification model
`TRUSTEDROUTER_CLASSIFICATION_MODEL`		TrustedRouter classification model
`DEEPSEEK_CLASSIFICATION_MODEL`		DeepSeek classification model
`GEMINI_CLASSIFICATION_MODEL`		Gemini classification model
`NVIDIA_CLASSIFICATION_MODEL`		NVIDIA classification model
`MINIMAX_CLASSIFICATION_MODEL`		MiniMax classification model
`GROQ_CLASSIFICATION_MODEL`		Groq classification model

Overview

Local

Enterprise

Environment guides

Configuration

Secret storage

LLM providers

LLM Reasoning Effort

CLI investigation tools

Output & Debugging

Credentials and authentication

Telemetry & Monitoring

Paths & Directories

Memory

Remote sync

Masking

Feature Flags

Integration credentials

Multi-instance integrations

LLM classification models

​Secret storage

​LLM providers

​LLM Reasoning Effort

​CLI investigation tools

​Output & Debugging

​Credentials and authentication

​Telemetry & Monitoring

​Paths & Directories

​Memory

​Remote sync

​Masking

​Feature Flags

​Integration credentials

​Multi-instance integrations

​LLM classification models

Secret storage

LLM providers

LLM Reasoning Effort

CLI investigation tools

Output & Debugging

Credentials and authentication

Telemetry & Monitoring

Paths & Directories

Memory

Remote sync

Masking

Feature Flags

Integration credentials

Multi-instance integrations

LLM classification models